Merge pull request #847 from anarcat/no-backports-key

don't hardcode an old key from official mirrors for Debian backports

diff --git a/.gitignore b/.gitignore
index 88cf7a6c6ef4373af088169cdf6082e7b9855fb3..3f4e2e84942fa912f14261ac2fcb152f1f1c130a 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -22,5 +22,5 @@
 /convert_report.txt
 /update_report.txt
 .DS_Store
-.vscode/
 .envrc
+/inventory.yaml

diff --git a/.pdkignore b/.pdkignore
index 2ec773abe21f5128134b4ae7b1218e9aeda2b8c8..54d2cda3ab0c538a2ec753012adb017765ced20a 100644 (file)
--- a/.pdkignore
+++ b/.pdkignore
@@ -22,8 +22,8 @@
 /convert_report.txt
 /update_report.txt
 .DS_Store
-.vscode/
 .envrc
+/inventory.yaml
 /appveyor.yml
 /.fixtures.yml
 /Gemfile
@@ -32,8 +32,10 @@
 /.gitlab-ci.yml
 /.pdkignore
 /Rakefile
+/rakelib/
 /.rspec
 /.rubocop.yml
 /.travis.yml
 /.yardopts
 /spec/
+/.vscode/

diff --git a/.puppet-lint.rc b/.puppet-lint.rc
index 8b137891791fe96927ad78e64b0aad7bded08bdc..cc96ece0513d69709b87af611173e2a6e4532f62 100644 (file)
--- a/.puppet-lint.rc
+++ b/.puppet-lint.rc
@@ -1 +1 @@
-
+--relative

diff --git a/.travis.yml b/.travis.yml
index 88c55fd2241ec17692ed6d47b1cbd2659be95b96..d04fe6181ed8aa8b509aa8754e74af9a87b9f024 100644 (file)
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,5 +1,4 @@
 ---
-dist: trusty
 language: ruby
 cache: bundler
 before_install:
@@ -12,10 +11,14 @@ script:
   - 'bundle exec rake $CHECK'
 bundler_args: --without system_tests
 rvm:
-  - 2.5.1
-env:
-  global:
-    - BEAKER_PUPPET_COLLECTION=puppet6 PUPPET_GEM_VERSION="~> 6.0"
+  - 2.5.3
+stages:
+  - static
+  - spec
+  - acceptance
+  -
+    if: tag =~ ^v\d
+    name: deploy
 matrix:
   fast_finish: true
   include:
@@ -23,25 +26,34 @@ matrix:
       bundler_args: 
       dist: trusty
       env: PUPPET_INSTALL_TYPE=agent BEAKER_debug=true BEAKER_PUPPET_COLLECTION=puppet6 BEAKER_set=docker/debian-8 BEAKER_TESTMODE=apply
-      rvm: 2.5.1
+      rvm: 2.5.3
       script: bundle exec rake beaker
       services: docker
+      stage: acceptance
       sudo: required
     -
       bundler_args: 
       dist: trusty
       env: PUPPET_INSTALL_TYPE=agent BEAKER_debug=true BEAKER_PUPPET_COLLECTION=puppet6 BEAKER_set=docker/ubuntu-14.04 BEAKER_TESTMODE=apply
-      rvm: 2.5.1
+      rvm: 2.5.3
       script: bundle exec rake beaker
       services: docker
+      stage: acceptance
       sudo: required
     -
-      env: CHECK="syntax lint metadata_lint check:symlinks check:git_ignore check:dot_underscore check:test_file rubocop"
-    -
-      env: CHECK=parallel_spec
+      env: CHECK="check:symlinks check:git_ignore check:dot_underscore check:test_file rubocop syntax lint metadata_lint"
+      stage: static
     -
       env: PUPPET_GEM_VERSION="~> 5.0" CHECK=parallel_spec
-      rvm: 2.4.4
+      rvm: 2.4.5
+      stage: spec
+    -
+      env: PUPPET_GEM_VERSION="~> 6.0" CHECK=parallel_spec
+      rvm: 2.5.3
+      stage: spec
+    -
+      env: DEPLOY_TO_FORGE=yes
+      stage: deploy
 branches:
   only:
     - master

diff --git a/lib/puppet/provider/apt_key/apt_key.rb b/lib/puppet/provider/apt_key/apt_key.rb
index 494dd12d1e822de61e7053a90c6f7aa61f29d4df..9f70cc65a2058c06d8671b22a7f1c86dfa3f40bf 100644 (file)
--- a/lib/puppet/provider/apt_key/apt_key.rb
+++ b/lib/puppet/provider/apt_key/apt_key.rb
@@ -126,7 +126,11 @@ Puppet::Type.type(:apt_key).provide(:apt_key) do
         # Only send basic auth if URL contains userinfo
         # Some webservers (e.g. Amazon S3) return code 400 if empty basic auth is sent
         if parsed_value.userinfo.nil?
-          key = parsed_value.read
+          key = if parsed_value.scheme == 'https' && resource[:weak_ssl] == true
+                  open(parsed_value, ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE).read
+                else
+                  parsed_value.read
+                end
         else
           user_pass = parsed_value.userinfo.split(':')
           parsed_value.userinfo = ''

diff --git a/lib/puppet/type/apt_key.rb b/lib/puppet/type/apt_key.rb
index 467f568af4a74ff475fb2ed77da0e2c31298dc16..8c5c84c886f83c3bc296b0e06e50ff73af3d1391 100644 (file)
--- a/lib/puppet/type/apt_key.rb
+++ b/lib/puppet/type/apt_key.rb
@@ -80,6 +80,11 @@ Puppet::Type.newtype(:apt_key) do
     defaultto false
   end
 
+  newparam(:weak_ssl, boolean: true, parent: Puppet::Parameter::Boolean) do
+    desc 'When true and source uses https, accepts download of keys without SSL verfication'
+    defaultto false
+  end
+
   newproperty(:fingerprint) do
     desc <<-MANIFEST
       The 40-digit hexadecimal fingerprint of the specified GPG key.

diff --git a/manifests/key.pp b/manifests/key.pp
index 13b477060d679786677697db0fab9a1b60dc61d5..1f9a495f54f4f3f19424fe571842ed04955bd46f 100644 (file)
--- a/manifests/key.pp
+++ b/manifests/key.pp
@@ -29,6 +29,9 @@
 #   Specifies a keyserver to provide the GPG key. Valid options: a string containing a domain name or a full URL (http://, https://,
 #   hkp:// or hkps://). The hkps:// protocol is currently only supported on Ubuntu 18.04.
 #
+# @param weak_ssl
+#    Specifies whether strict SSL verification on a https URL should be disabled. Valid options: true or false.
+#
 # @param options
 #   Passes additional options to `apt-key adv --keyserver-options`.
 #
@@ -38,6 +41,7 @@ define apt::key (
   Optional[String] $content                                                                          = undef,
   Optional[Pattern[/\Ahttps?:\/\//, /\Aftp:\/\//, /\A\/\w+/]] $source                                = undef,
   Pattern[/\A((hkp|hkps|http|https):\/\/)?([a-z\d])([a-z\d-]{0,61}\.)+[a-z\d]+(:\d{2,5})?$/] $server = $::apt::keyserver,
+  Boolean $weak_ssl                                                                                  = false,
   Optional[String] $options                                                                          = undef,
   ) {
 
@@ -49,13 +53,14 @@ define apt::key (
 
       if !defined(Anchor["apt_key ${id} present"]) {
         apt_key { $title:
-          ensure  => present,
-          refresh => $ensure == 'refreshed',
-          id      => $id,
-          source  => $source,
-          content => $content,
-          server  => $server,
-          options => $options,
+          ensure   => present,
+          refresh  => $ensure == 'refreshed',
+          id       => $id,
+          source   => $source,
+          content  => $content,
+          server   => $server,
+          weak_ssl => $weak_ssl,
+          options  => $options,
         } -> anchor { "apt_key ${id} present": }
 
         case $facts['os']['name'] {
@@ -83,12 +88,13 @@ define apt::key (
 
       if !defined(Anchor["apt_key ${id} absent"]){
         apt_key { $title:
-          ensure  => $ensure,
-          id      => $id,
-          source  => $source,
-          content => $content,
-          server  => $server,
-          options => $options,
+          ensure   => $ensure,
+          id       => $id,
+          source   => $source,
+          content  => $content,
+          server   => $server,
+          weak_ssl => $weak_ssl,
+          options  => $options,
         } -> anchor { "apt_key ${id} absent": }
       }
     }

diff --git a/metadata.json b/metadata.json
index 04066db95b85c9f08867a46e922e94f84fa55720..53c8f7bc72f07accb165da10d5f95c22d5aaecc8 100644 (file)
--- a/metadata.json
+++ b/metadata.json
@@ -37,10 +37,10 @@
   "requirements": [
     {
       "name": "puppet",
-      "version_requirement": ">= 4.8.0 < 7.0.0"
+      "version_requirement": ">= 5.5.10 < 7.0.0"
     }
   ],
-  "template-url": "https://github.com/puppetlabs/pdk-templates",
-  "template-ref": "heads/master-0-gfde5699",
-  "pdk-version": "1.8.0"
-}
\ No newline at end of file
+  "template-url": "https://github.com/puppetlabs/pdk-templates#master",
+  "template-ref": "heads/master-0-gf778803",
+  "pdk-version": "1.10.0"
+}

diff --git a/spec/acceptance/apt_key_provider_spec.rb b/spec/acceptance/apt_key_provider_spec.rb
index f3dc4d38889755b99c1eddf0dcdb5c8dbb019872..18c885728ecc1ae28873a65f9a2e8eb5c1936ee4 100644 (file)
--- a/spec/acceptance/apt_key_provider_spec.rb
+++ b/spec/acceptance/apt_key_provider_spec.rb
@@ -533,6 +533,15 @@ https_works_pp = <<-MANIFEST
         }
   MANIFEST
 
+https_with_weak_ssl_works_pp = <<-MANIFEST
+        apt_key { 'puppetlabs':
+          id     => '#{PUPPETLABS_GPG_KEY_LONG_ID}',
+          ensure => 'present',
+          source => 'https://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}',
+          weak_ssl => true,
+        }
+  MANIFEST
+
 https_userinfo_pp = <<-MANIFEST
         apt_key { 'puppetlabs':
           id     => '#{PUPPETLABS_GPG_KEY_LONG_ID}',
@@ -793,6 +802,11 @@ describe 'apt_key' do
         shell(PUPPETLABS_KEY_CHECK_COMMAND)
       end
 
+      it 'works with weak ssl' do
+        apply_manifest_twice(https_with_weak_ssl_works_pp)
+        shell(PUPPETLABS_KEY_CHECK_COMMAND)
+      end
+
       it 'works with userinfo' do
         apply_manifest_twice(https_userinfo_pp)
         shell(PUPPETLABS_KEY_CHECK_COMMAND)

diff --git a/spec/unit/puppet/provider/apt_key_spec.rb b/spec/unit/puppet/provider/apt_key_spec.rb
index a514793bae96a01cf1e2beef0b500f7e7727a926..ca35ff7d6b10986e28329bf70c41293ba5ec6528 100644 (file)
--- a/spec/unit/puppet/provider/apt_key_spec.rb
+++ b/spec/unit/puppet/provider/apt_key_spec.rb
@@ -113,6 +113,21 @@ OUTPUT
       expect(provider).to be_exist
     end
 
+    it 'apt_key with source and weak ssl verify set' do
+      expect(described_class).to receive(:apt_key).with(array_including('add', kind_of(String)))
+      resource = Puppet::Type::Apt_key.new(name: 'gsd',
+                                           id: 'C105B9DE',
+                                           source: 'https://bla/herpderp.gpg',
+                                           ensure: 'present',
+                                           weak_ssl: true)
+
+      provider = described_class.new(resource)
+      expect(provider).not_to be_exist
+      expect(provider).to receive(:source_to_file).and_return(Tempfile.new('foo'))
+      provider.create
+      expect(provider).to be_exist
+    end
+
     describe 'different valid id keys' do
       hash_of_keys = {
         '32bit key id' => 'EF8D349F',

diff --git a/spec/unit/puppet/type/apt_key_spec.rb b/spec/unit/puppet/type/apt_key_spec.rb
index 5b205e9924b3d749944b973a8c91cdd31a8d901e..253b6448747f8c4d7dacde60edc2aa82eb84ab76 100644 (file)
--- a/spec/unit/puppet/type/apt_key_spec.rb
+++ b/spec/unit/puppet/type/apt_key_spec.rb
@@ -32,6 +32,10 @@ describe Puppet::Type.type(:apt_key) do
     it 'refresh is not set' do
       expect(resource[:refresh]).to eq nil
     end
+
+    it 'weak_ssl is not set' do
+      expect(resource[:weak_ssl]).to eq nil
+    end
   end
 
   context 'with a lowercase 32bit key id' do
@@ -107,6 +111,20 @@ describe Puppet::Type.type(:apt_key) do
     end
   end
 
+  context 'with source and weak_ssl' do
+    let(:resource) do
+      Puppet::Type.type(:apt_key).new(
+        id: 'EF8D349F',
+        source: 'https://apt.puppetlabs.com/pubkey.gpg',
+        weak_ssl: true,
+      )
+    end
+
+    it 'source is set to the URL' do
+      expect(resource[:source]).to eq 'https://apt.puppetlabs.com/pubkey.gpg'
+    end
+  end
+
   context 'with content' do
     let(:resource) do
       Puppet::Type.type(:apt_key).new(